AGL hits half-million milestone with passkey adoption

Image credit: AGL/Oktane.

AGL has reached 500,000 unique customer enrolments for passkeys since introducing them as an authentication option for its customer portal and app in December last year.

Speaking at Okta’s annual Oktane conference in the US late last month, digital product owner Ana Alvarado provided an overview of the authentication upgrade program, which saw the utility introduce mandatory two-factor authentication, and then passkeys as a passphrase-less authentication option.

Alvarado said that a key focus of the implementation team was on limiting “friction” in the sign-in process.

“For most customers, signing into the front door is their relationship with AGL. Whether they're viewing a bill, managing payments, including moving house, checking energy usage, or any of their sales requirements. Their entire journey starts at login,” she said.

“The challenge is that authentication is also where the friction most frequently occurs: failed logins, forgotten passwords, unexpected security prompts. It quickly turns into customer frustration and support calls. 

“So for our team, success isn't only measured by stronger security controls, but delivering security in a way that customers barely notice.”

Mandatory two-factor authentication (2FA) naturally meant additional steps compared to the previous credential-based sign-in process.

But the hope was that customers wanting faster and more secure authentication would then set up passkey access through their devices.

Nine months in, and passkey adoption among digitally-active users continues to grow, Alvarado said.

“We're seeing strong passkey adoption, reaching 500,000 unique customer enrolments, which bring our overall adoption rate to 30.5 percent,” she said.

Those that enrolled typically achieved a 30-second reduction in average login time to the website or app, she added.

For “baseline” 2FA, AGL has “hit one million sign-ins since December with 10.4 million total logins, all with a support call rate of less than 0.01 percent.”

Tech stack

Behind the scenes, AGL said it “combined multiple platform components within Auth0” to underpin the authentication upgrade, and to encourage users to adopt passkeys. Okta acquired Auth0 back in 2021.

“Advanced [Customisations for] Universal Login was a major enabler and allowed us to customise and control authentication, whilst Auth0 Forms enabled us to build guided enrolment and registration experiences without unnecessary complexity into the solution,” Alvarado said.

“Auth0 Actions became our primary orchestration layer, allowing us the flexibility to set logic and enforce business rules.

“Passkey users require ongoing credential management, not just initial registration, so the My Account API allows our customers to create, remove, view, and revoke passkeys. 

“Last of all, our base, Universal Login, provides the secure foundation in underpinning the full solution that allows us to leverage Advanced Custom Login, Auth0, and Actions. 

“The outcome came from onboarding all of these capabilities.”

Driving users towards passkeys

Alvarado said that introducing new security patterns for authentication “was as much an adoption challenge as a technical one.

“We staged the rollout deliberately to minimise disruption, prepared customers for all major changes through communication, rolled out mandatory two-factor authentication, introduced passkey enrolment once 2FA was set, and drove adoption ongoing through targeted messaging,” she said.

“By establishing 2FA before introducing passkeys, we would create a logical progression for traditional logins to passwordless authentication.”

“Throughout the rollout, we closely tracked enrolment, completion rates, drop-off points, and authentication behaviour in real time.”

The cutover was essentially a “big bang” deployment, with two initial releases to user groups of 100,000, before upgrading the security requirements for “everyone else at the same time”, Alvarado said.

To encourage users to adopt passkeys, AGL customised the way this option was presented to customers, with Auth0 critical to enabling that customisation.

“We recognise that customers logging in to pay a bill aren't always ready to set up new credentials on the spot, [so] by introducing ‘skip’ or ‘remind me later’ options, we gave users control to defer enrolment,” she said.

“We [also] introduced a dedicated passkey button at our login, giving customers a familiar entry point on any device, and also by using clear, transparent language, it built trust at every point.”

Alvarado said that rather than force users into a standalone passkey setup journey, “passkey prompts were embedded directly within the existing routine login flow, so customers were guided to enrol.”

“[As] the passkeys rely heavily on hardware capabilities, our flows dynamically adapted to them, surfacing passkey options only when the user's current device and browser actively supported them, [and] presenting clear instructions tailored to the specific environment,” she said.

“Passkey registration and fallback [to an alternative authentication method] flows vary significantly between platforms, therefore, we built our logic around authenticated customer behaviour by considering user-centred design every step of the way. 

“To support real-world habits, we designed enrolment flows that allow users to start, pause, or resume registration across different sessions and devices.”

AGL also built a security dashboard into its web portal and app “where customers can view, add or revoke passkeys at any time.”